Binance Reveals How Fake Job Interviews and Compromised AI Tools Enabled $6.34 Billion Hack
Binance has revealed that the hackers behind its $6.34 billion cryptocurrency security breach spent months targeting employees through fake job interviews, malicious software downloads, and compromised internal systems. The attackers eventually used stolen credentials and an internal artificial intelligence tool to gain access to the exchange’s wallet infrastructure.
The findings were published on November 3, 2026, in Binance’s first detailed report examining the October 29 security incident.
According to the official Binance investigation report, the operation began as early as June and involved multiple employees responsible for developing and maintaining cryptocurrency wallet systems.
The company says the attackers ultimately gained access to an internal wallet-signing service and used it to authorize transactions outside the normal customer withdrawal process.
Binance estimates that approximately $6.34 billion in digital assets was affected.
As of its latest report, the exchange says it has frozen or intercepted approximately $2.85 billion and replenished 98% of impacted token assets using its financial resources.
The investigation remains ongoing, and Binance says independent cybersecurity experts will review its findings.
What Has Binance Revealed About the Hack?
When Binance first disclosed the security incident on October 30, it said an employee’s compromised computer may have provided attackers with access to internal systems.
The latest report presents a more complicated picture.
According to Binance, the hackers spent several months gathering information, compromising employee devices, and searching for a way into the exchange’s wallet infrastructure.
The operation involved at least three engineers, identified in the company’s report as Engineer A, Engineer B, and Engineer C.
The attack was not described as a single password theft or a direct compromise of a cryptocurrency private key.
Instead, the attackers allegedly exploited a chain of weaknesses involving software installations, recruitment scams, employee computers, internal permissions, and transaction authorization systems.
The company has not released every technical detail, partly because it says doing so could help other attackers reproduce the methods.
How Did the Binance Hack Begin in June 2026?
According to Binance, the first known stage occurred in June.
An engineer working in the exchange’s Wallet DevOps team searched online for a popular AI coding tool.
During installation, the engineer downloaded a modified version of Homebrew, a software package manager commonly used by developers.
A package manager helps people install and maintain software applications and development tools.
In this case, the installer had reportedly been tampered with.
The malicious software gave attackers an opportunity to collect information about the employee and the systems they worked with.
Binance says its security team detected the suspicious activity, replaced the affected device, and changed the related credentials.
However, the attackers had already learned information about the engineer’s responsibilities and colleagues.
That information appears to have helped them prepare subsequent attacks.
Why is this important?
This stage illustrates a common cybersecurity problem known as a supply-chain attack.
A supply-chain attack happens when criminals compromise software, an installation process, or another trusted component that users depend on.
The victim may believe they are installing a legitimate tool.
But the software contains malicious instructions.
For developers, the risk is especially serious because their computers may contain access credentials, development environments, and connections to sensitive systems.
How Did Fake Job Interviews Help the Hackers?
The next major stage took place in September 2026.
Binance says another software engineer was contacted through a legitimate job-hunting platform.
The engineer’s public profile mentioned their experience working at Binance.
The person making contact claimed to be a project director at another company.
The supposed employer then arranged interviews involving individuals pretending to represent its human resources team and senior management.
The first interview was conducted over video.
According to Binance, the interviewer used social media accounts containing personal photographs and videos to appear credible.
A second interview took place through a messaging application.
During that process, the engineer was asked to download a coding assignment.
The assignment was presented as part of the recruitment process.
However, it contained malicious software.
When the engineer set up the project, the malicious code executed on the work computer.
The attackers had successfully turned an apparent career opportunity into a way of gaining access to company infrastructure.
What is social engineering?
Social engineering is a form of manipulation in which an attacker tricks someone into taking an action that compromises security.
Instead of directly breaking encryption or guessing passwords, the attacker exploits trust.
For example, a criminal may impersonate a recruiter, customer support employee, bank official, or company executive.
They may ask the victim to download software, open a link, disclose information, or approve a transaction.
The fake Binance recruitment process was particularly sophisticated because the attackers reportedly invested time in building credibility before introducing the malicious coding assignment.
What Did the Malicious Coding Assignment Do?
Binance’s report says the malicious software attempted to evade endpoint protection tools.
Endpoint protection is security software designed to detect suspicious activity on devices such as laptops and desktop computers.
The malicious code reportedly replaced part of a legitimate development tool with a modified version.
That allowed the attackers to execute commands and establish communication with infrastructure under their control.
The code also attempted to conceal its activity.
Binance says the malware was not detected by the endpoint security tools in place at the time.
This highlights a difficult problem for organizations.
Even companies with security software can be vulnerable when attackers develop malware specifically designed to avoid existing detection methods.
The incident also demonstrates why downloading unfamiliar code onto a work computer can create serious risks.
How Was an Internal AI Tool Involved?
On October 20, the attackers reportedly used the compromised computer belonging to Engineer B to access additional internal systems.
Binance says they used an internal AI tool as part of the process that gave them control over computers belonging to Engineers A and C.
The attackers then identified a container deployment permission token on one of the compromised computers.
A deployment permission token is a credential that can allow an authorized user or system to deploy software into a computing environment.
Such permissions are sensitive because they may give access to production services.
According to Binance, the attackers eventually used the stolen credentials and access to another engineer’s device to deploy a malicious container.
That container became part of the attack path into the wallet infrastructure.
What Happened on October 29?
According to Binance, the attackers used the compromised engineering environment to reach the exchange’s internal wallet-signing infrastructure.
A wallet-signing service is a system used to authorize cryptocurrency transactions.
Cryptocurrency exchanges rely on such systems to process legitimate transfers while preventing unauthorized movements.
In this case, Binance says the attackers obtained sufficient access to initiate transactions outside the usual withdrawal workflow.
The report identifies several major asset movements.
| Cryptocurrency | Reported unauthorized movement |
|---|---|
| XRP | 233.46 million XRP |
| SOL | Approximately 970,500 SOL |
| OP | Approximately 44.2 million OP |
| BTC | 18,270 BTC |
| ETH | Additional transfers through the compromised authorization mechanism |
These figures are drawn from Binance’s preliminary incident report.
They are not a complete accounting of every affected asset.
Binance says its internal systems detected unusually large transfers and triggered an investigation.
However, the attackers had already established additional methods of moving assets.
Those methods made containment more complicated.
Why Did Stopping Withdrawals Not Immediately Stop the Attack?
One of the most important technical details involves Ethereum’s EIP-7702 mechanism.
EIP-7702 allows certain Ethereum accounts to delegate execution permissions to smart-contract code.
A smart contract is software that performs actions on a blockchain according to programmed rules.
Delegation can be useful for legitimate wallet features, such as more flexible transaction management.
However, Binance says the attackers used unauthorized access to its wallet-signing infrastructure to establish malicious delegation permissions.
Those permissions allowed further transactions to occur outside the exchange’s normal withdrawal process.
This meant simply suspending withdrawals did not immediately remove the attackers’ existing on-chain permissions.
Binance had to carry out additional transactions to revoke the unauthorized authorizations.
The exchange also says the relevant wallet used multi-party computation, or MPC.
MPC is a security technique that distributes sensitive cryptographic operations across multiple participants or systems.
It is designed to avoid relying on a single exposed private key.
However, Binance says the arrangement made its emergency revocation procedure more complicated.
The company had to develop and execute a specialized process to remove the malicious authorizations.
According to the report, the final unauthorized ETH transfer was finalized on-chain at 23:56 UTC on October 29.
Binance says the relevant delegation code was cleared shortly after midnight UTC on October 30.
Who Was Behind the Binance Hack?
The US Federal Bureau of Investigation has attributed the incident to North Korean state-linked hackers.
According to Reuters’ November 3 report, the FBI’s attribution identifies the operation as part of activity associated with North Korean cybercriminal groups.
North Korea has rejected responsibility.
The distinction matters.
The FBI attribution is an official investigative assessment, while North Korea’s denial is the accused government’s position.
Binance’s technical report provides details about how the attack allegedly occurred, but it does not publish the complete underlying evidence establishing the attackers’ identities.
For that reason, responsibility should be attributed to the FBI’s findings rather than described as a conviction or independently proven identity.
How Much Cryptocurrency Has Binance Recovered?
Binance has updated several figures since initially disclosing the breach.
Its November 3 report provides the following estimates:
| Measure | Latest reported figure |
|---|---|
| Total affected cryptocurrency | $6.34 billion |
| Frozen or intercepted assets | Approximately $2.85 billion |
| Impacted token assets replenished | 98% |
| Investigation | Ongoing |
| Independent security review | Being commissioned |
It is important to understand that frozen, recovered, and replenished assets are not the same thing.
Frozen assets
Cryptocurrency is frozen when it has been restricted from moving, for example through action by a stablecoin issuer or another authorized party.
The funds may still require legal or technical processes before they can be returned.
Recovered assets
Recovered assets are funds successfully returned to the rightful holder or otherwise regained by the victim.
Replenished assets
Replenished assets are replacement funds supplied from another source, such as the exchange’s corporate treasury or emergency reserves.
Binance says it has set aside enough resources to cover the loss and has replenished 98% of impacted token assets.
This does not mean 98% of the original stolen cryptocurrency has been recovered from the hackers.
Binance says the outstanding assets are generally less-liquid tokens that require additional time to purchase.
What Has Binance Done to Improve Security?
The company says it has taken several measures since the attack.
These include rebuilding the affected wallet infrastructure, replacing compromised devices, revoking exposed credentials, and strengthening access controls.
Binance also says it rebuilt the affected internal AI tool and reviewed employee devices.
The exchange plans to expand behavioral monitoring, strengthen wallet-service controls, and invest more in AI-based threat detection.
It has also announced plans to establish a security research fund and work with industry participants on AI-related cybersecurity risks.
These are announced measures and plans.
Their effectiveness will need to be assessed over time.
Binance says independent cybersecurity specialists will review the incident and recommend additional improvements.
The company has not yet published the conclusions of that independent review.
Frequently Asked Questions
How was Binance hacked in October 2026?
Binance says attackers used malicious developer software, fake job interviews, compromised employee devices, stolen credentials, and an internal AI tool to access its wallet infrastructure.
How much cryptocurrency was stolen?
Binance estimates that approximately $6.34 billion in digital assets was affected.
Did the hackers use fake job interviews?
Yes. According to Binance’s preliminary investigation, one engineer downloaded a malicious coding assignment during a fraudulent recruitment process.
Did AI itself steal the cryptocurrency?
Binance says attackers compromised and used an internal AI tool during the attack. It has not established that an autonomous AI system independently planned or carried out the theft.
Did the hackers steal Binance’s private keys?
The report describes compromised signing infrastructure and malicious transaction authorizations rather than confirming a direct leak of complete wallet private keys.
What is EIP-7702?
EIP-7702 is an Ethereum mechanism that allows certain accounts to delegate execution permissions to smart-contract code. Binance says attackers misused its authorization process.
How much has Binance frozen?
The company reported approximately $2.85 billion in assets frozen or intercepted as of November 3, 2026.
Has Binance recovered 98% of the stolen funds?
Not necessarily. Binance says it has replenished 98% of impacted token assets, which includes replacing assets using company funds.
Was North Korea responsible?
The FBI has attributed the attack to North Korean-linked hackers. North Korea has denied responsibility.
Is Binance’s investigation complete?
No. Binance has published initial findings and says independent cybersecurity experts will review the incident.
Key Takeaways
- Binance published its first detailed incident report on November 3, 2026.
- The company says the attack involved a coordinated campaign beginning in June.
- Attackers allegedly used malicious software and fake job interviews to compromise engineers.
- A compromised internal AI tool was used to expand access to sensitive systems.
- The attackers reached wallet-signing infrastructure and initiated unauthorized transactions.
- Binance estimates approximately $6.34 billion in digital assets was affected.
- Around $2.85 billion has been frozen or intercepted, according to the company.
- Binance says 98% of impacted token assets has been replenished.
- The FBI attributes the incident to North Korean-linked hackers, while North Korea denies responsibility.
- An independent cybersecurity review remains pending.
